Bluehost Hosting service cannot chage DKIM, SPF & Dmark

[Manny73]

Blue host can not seem to modify DNS to support Hubspots requirement to run email through my domain. Hard to believe since both organizations are so large. What am I missing? Should I change providers or kill Hubspot?

[RubenBurdin]

Hello @Manny73

I know how maddening it feels when HubSpot says “add two CNAMEs, one TXT” and Bluehost’s DNS panel just shrugs.

From what I know, the good news is you don’t need to ditch either platform you just have to slip past Bluehost’s Basic DNS screen and add the records in the Advanced / Zone Editor, which does accept underscores and multiple CNAMEs.

What HubSpot actually needs
HubSpot’s auth checklist (DKIM = two CNAMEs, SPF = one TXT, DMARC = one TXT) is here: Manage email authentication KB. knowledge.hubspot.com

Where Bluehost hides the right editor

1. Log in → Domains → click Manage next to the domain → hit the DNS tab.

2. Scroll to the CNAME (Alias) section and click Add Record (Bluehost guide). bluehost.com

3. Paste HubSpot’s first CNAME host:
   xxxxxxxx._domainkey → Points to xxxxxxxx.dkim.hubspotemail.net
   Do the second CNAME the same way. Underscores are valid here—even if the basic editor once blocked them, the Zone Editor accepts them.

4. Still in the Zone Editor, add a TXT record for SPF:
   Host @ → Value v=spf1 include:123456.spf03.hubspotemail.net -all (append to an existing SPF if you already have one).

5. Finally, add your DMARC TXT record (_dmarc host) as recommended by HubSpot.

If Bluehost throws an “invalid host” error

It usually means you’re on the simplified DNS screen; switch to Advanced (or cPanel › Zone Editor on older plans) and try again. Bluehost’s own help article notes that CNAMEs with underscores must be created in that view. support.strikingly.com

Still can’t add? Two fallback moves
• Point your nameservers to Cloudflare (free) or Route 53, manage DNS there, leave the site on Bluehost hosting.
• Or create a sub-domain like mail.yourdomain.com, delegate that sub-domain’s DNS to Cloudflare, authenticate HubSpot on the sub-domain, leave the root with Bluehost. Works when IT won’t move the primary zone.

Once the records verify (HubSpot › Settings › Domains & URLs › Email sending), deliverability jumps and Gmail/Outlook stop slapping the “via hs-send” badge.

From what I’ve seen, pulling the records into the Zone Editor is the clean fix—no provider switch needed.

Hope this helps.

[Manny73 · Accepted solution]

After multiple attempts I was able to get the zone editor to accept the prompts. Thanks for the help though.

[ArisudanTiwari]

Hi @Manny73 ,

Totally get where you're coming from, these kinds of challenges are pretty common, especially when you're trying to connect third-party email services like HubSpot with shared hosting platforms like Bluehost.

Here are a few things you can try that might help:

1. Double-check the required records from HubSpot
   HubSpot has a great guide on this — you can find it here: https://knowledge.hubspot.com/marketing-email/manage-email-authentication-in-hubspot

2. Use Bluehost’s Advanced DNS Editor (if it's available)

   • Log in to your Bluehost account and head to the DNS Zone Editor (under “Advanced” or “Domains” sometimes).

   • Manually add the TXT records for SPF and DKIM provided by HubSpot.

   • If you don’t see that option, Bluehost might be limiting DNS changes

3. As a last resort – switch DNS providers
   If Bluehost proves too restrictive, you might want to move your domain's DNS management (not your full website) to a provider like Cloudflare, Google Domains, or Namecheap. They give you much more control.